PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-39493 Siemens CVE debrief

This CVE addresses a memory leak and potential use-after-free (UAF) vulnerability in the Linux kernel's Intel QuickAssist Technology (QAT) crypto driver. The flaw exists in the ADF_DEV_RESET_SYNC mechanism, where using completion_done to check if a caller has finished only works correctly after a complete call has been made. Additionally, a race condition exists where the caller may not yet have invoked wait_for_completion, leading to potential UAF conditions. The fix involves modifying the caller to use cancel_work_sync and ensuring safe memory deallocation. Siemens has identified this vulnerability as affecting certain industrial networking products running SINEC OS, specifically the RUGGEDCOM RST2428P and SCALANCE X-family switches. The vulnerability is rated MEDIUM severity with a CVSS 3.1 score of 5.5, indicating local attack vector with low attack complexity and low privileges required, resulting in high availability impact.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Organizations running Siemens industrial networking equipment with SINEC OS versions prior to 3.1, including SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family switches, SCALANCE XCM-/XRM-/XCH-/XRH-300 family devices, and RUGGEDCOM RST2428P systems. Additionally, any Linux deployments utilizing Intel QuickAssist Technology cryptographic acceleration should verify kernel patch status.

Technical summary

The vulnerability resides in the Linux kernel's crypto/qat driver, specifically in the ADF_DEV_RESET_SYNC completion handling. The original implementation used completion_done() to determine if a caller had finished, which is unreliable before complete() is called and creates a race window where wait_for_completion() may not yet have been invoked by the caller. This results in memory leaks and potential use-after-free conditions. The corrected implementation uses cancel_work_sync() to properly synchronize work cancellation and ensure safe memory deallocation. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H indicates local attack vector, low complexity, low privileges required, no user interaction, and high availability impact with no confidentiality or integrity impact.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided updates to SINEC OS V3.1 or later for affected Siemens SCALANCE and RUGGEDCOM products
  • For Linux kernel deployments, ensure kernel version includes the crypto/qat driver fix using cancel_work_sync pattern
  • Review and update kernel configurations for systems utilizing Intel QuickAssist Technology (QAT) cryptographic acceleration
  • Implement defense-in-depth strategies for industrial control systems per CISA recommended practices
  • Monitor vendor security advisories for additional affected product announcements

Evidence notes

The vulnerability was disclosed in the Linux kernel crypto/qat driver. Siemens ProductCERT published advisory SSA-613116 addressing affected SINEC OS products. CISA republished this advisory as ICSA-25-226-15 on 2025-08-12, with subsequent updates through 2026-02-25 to correct affected product listings and remove rejected CVEs. The fix involves replacing completion_done checks with cancel_work_sync to prevent memory leaks and UAF conditions during device reset synchronization.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-39493 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-39493

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-39493 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-39493

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.